mirror of
https://mau.dev/maunium/synapse.git
synced 2024-06-01 10:18:54 +02:00
a986f86c82
In previous versions of authlib using `client_secret_basic` without a `client_secret` would result in an invalid auth header. Since authlib 1.3 it throws an exception. The configuration may be accepted in by very lax servers, so we don't want to deny it outright. Instead, let's default the `client_auth_method` to `none`, which does the right thing. If the config specifies `client_auth_method` and no `client_secret` then that is going to be bogus and we should reject it
2 lines
91 B
Plaintext
2 lines
91 B
Plaintext
Reject OIDC config when `client_secret` isn't specified, but the auth method requires one.
|